[PATCH 1/1] audit: log binding and unbinding to netlink multicast

[Steve Grubb]

On Monday, October 16, 2017 6:06:47 PM EDT Steve Grubb wrote:
> > > +/* Log information about who is connecting to the audit multicast
> > > socket
> > > */ +static void audit_log_multicast_bind(int group, const char *op, int
> > > err) +{
> > > +       const struct cred *cred;
> > > +       struct tty_struct *tty;
> > > +       char comm[sizeof(current->comm)];
> > > +       struct audit_buffer *ab;
> > > +
> > > +       ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_EVENT_LISTENER);
> > 
> > It really seems like this should be associated with the current task,
> > e.g. "audit_log_start(current->audit_context, ...)".  After all, the
> > whole point of this record is to capture information about the subject
> > who is binding to the multicast socket.
> 
> OK, easy enough.

But wouldn't that make it an auxiliary record (if there happens to be a 
syscall record) instead of a standalone event? The intention is that this 
event is standalone just like AUDIT_SECCOMP or AUDIT_LOGIN. Associating with 
the current task is done by using current in formatting the message as seen 
below. (e.g.  task_pid_nr(current), audit_get_sessionid(current))

I think it's correct as is.

-Steve

> > +       if (!ab)
> > +               return;
> > +
> > +       cred = current_cred();
> > +       tty = audit_get_tty(current);
> > +
> > +       audit_log_format(ab, "pid=%u uid=%u auid=%u tty=%s ses=%u",
> > +                       task_pid_nr(current),
> > +                       from_kuid(&init_user_ns, cred->uid),
> > +                       from_kuid(&init_user_ns,
> > audit_get_loginuid(current)), +                       tty ? tty_name(tty)
> > : "(none)",
> > +                       audit_get_sessionid(current));
> > +       audit_put_tty(tty);
> > +       audit_log_task_context(ab); /* subj= */
> > +       audit_log_format(ab, " comm=");
> > +       audit_log_untrustedstring(ab, get_task_comm(comm, current));
> > +       audit_log_d_path_exe(ab, current->mm); /* exe= */